Signed URL

A signed URL is a web address with a cryptographic signature and expiry appended as query parameters, granting temporary access to a private resource. Servers and CDNs validate the signature before serving the file, so the link works only until it expires and cannot be altered without breaking the signature.

Signed URLs are how you share a private file without making it public. Rather than flipping an object to world-readable, you generate a link that proves a short-lived grant of access. Anyone with the link can fetch the file until the clock runs out; after that the same URL returns an access error.

People often conflate "signed URL" and "presigned URL." In practice the term presigned URL usually describes a link minted to upload to or download from object storage directly, while signed URL more often describes time-limited delivery of a private asset through a CDN or server. The mechanism — a signature plus expiry that the edge validates — is the same idea applied at different points in the pipeline.

Keep expiry windows short. A signed URL is a bearer token: whoever has it has access. Tight expiries limit the blast radius if a link leaks into logs, a referrer header, or a chat thread.

Related terms

Presigned URL

A presigned URL is a temporary, signed link that grants time-limited permission to upload or download a specific object in cloud storage without exposing account credentials. The signature encodes the allowed operation, object key, and an expiry, so whoever holds the URL can perform exactly that action until it expires.

CDN

A CDN (content delivery network) is a globally distributed set of servers that cache copies of your files close to users. When someone requests an asset, the nearest edge location serves it instead of your origin, cutting latency and offloading traffic. CDNs speed up images, video, downloads, and static sites worldwide.

Cache-Control

Cache-Control is an HTTP header that tells browsers and CDNs how to cache a response — for how long, and whether they may store it at all. Directives like max-age, public, private, no-cache, and immutable set freshness, control revalidation, and decide how aggressively an asset is reused.

ETag

An ETag (entity tag) is an identifier a server assigns to a specific version of a resource, often a hash of its contents. Clients send it back via the If-None-Match header so the server can reply 304 Not Modified when nothing has changed, saving bandwidth. It also helps detect mid-update conflicts.

How files.link fits in

On files.link, private files are served through short-lived signed URLs (10-minute expiry) while public files go straight over the global CDN — so you control exactly who can read what. private, encrypted file storage.

Get started

← Back to the glossary